OVHcloud CLI GitHub releases briefly served a secret-stealing binary
Original title: Hackers Compromise OVHcloud GitHub Repository to Distribute Secret-Stealing Malware
Compromised builds v0.11.0 through v0.15.0 were online for 94 minutes on October 19 before OVHcloud blocked them.
OVHcloud CEO Octave Klaba said an attacker used a developer’s GitHub account to place a malicious binary in the company’s CLI repository. The binary was built to retrieve secrets from users’ disks. The compromised release was identified at 14:47 on October 19, 2026, and blocked by 16:21. Klaba told anyone who downloaded the affected builds that day to update or delete them and to change secrets stored on disk. OVHcloud has not confirmed how many customers or credentials were affected.
Unconfirmed: OVHcloud has not confirmed exfiltration, a customer count, or how the developer GitHub account was compromised.
- Affected releases were v0.11.0, v0.12.0, v0.13.0, v0.14.0, and v0.15.0.
- Klaba said v0.10.0 and the upcoming v0.16.0 were not compromised.
- Initial checks found no other affected repositories; the account compromise is still being investigated.
- A customer report named the account HassenBF and questioned a rebuilt release asset.
Impact: Malicious CLI binary can retrieve secrets from disk
| Product | Affected | Fixed in |
|---|---|---|
| OVHcloud CLI | v0.11.0, v0.12.0, v0.13.0, v0.14.0, and v0.15.0 | v0.16.0 |
- 1.Update or delete CLI builds downloaded on October 19, 2026.
- 2.Change all secrets stored on disk if an affected build was used.
- Vendors
- OVHcloud
- Products
- OVHcloud CLIGitHub
From the original article
2 min read at gbhackers.com
OVHcloud has reported a supply-chain attack involving its command-line interface (CLI) repository. An attacker exploited a developer’s GitHub account to distribute a malicious binary designed to steal sensitive information from users’ disks. CEO Octave Klaba confirmed the incident on October 19, 2026, after a customer reported it.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.